gh-150449: Fix sqlite3.Blob crash with negative-step slices by ever0de · Pull Request #150450 · python/cpython

ever0de · 2026-05-26T05:25:23Z

Reading or writing a sqlite3.Blob with a negative-step slice such as blob[9:0:-2] caused a crash (SystemError on older versions, ValueError on current main) because the C code computed stop - start as the read length, which is negative for negative steps.

Fix subscript_slice() and ass_subscript_slice() in Modules/_sqlite/blob.c to handle both positive and negative steps correctly:

For step > 1: keep reading [start, stop) and indexing forward as before.
For step < -1: read the contiguous range [start+(len-1)*step, start] and index backward with stride -step.

Issue: sqlite3: Blob crashes when using a negative-step slice #150449

picnixz · 2026-05-26T08:22:54Z

+ // For positive step: read the contiguous range [start, stop) and pick
+ // every step-th byte. For negative step: read the contiguous range
+ // [start+(len-1)*step, start] and pick bytes in reverse stride order.
+ Py_ssize_t read_offset, read_length;


We have an adjust slice function somewhere in the codebase, use the latter instead.

sqlite3.Blob has no direct memory pointer — data can only be fetched via sqlite3_blob_read(blob, buf, nbytes, offset), which reads a single contiguous byte range. To keep that to one call, we must pre-compute the minimal covering range with Py_MIN/Py_ABS, then index into the local buffer as blob_buf[cur - read_offset].
The size_t cur += step loop itself is the same pattern as bytearrayobject.c; only the offset correction differs because our local buffer starts at read_offset, not 0.
bytearrayobject.c
Py_ssize_tstart, stop, step, slicelength, i; size_tcur; PySlice_Unpack(index, &start, &stop, &step); slicelength=PySlice_AdjustIndices(PyByteArray_GET_SIZE(self), &start, &stop, step); char*source_buf=PyByteArray_AS_STRING(self); char*result_buf=PyByteArray_AS_STRING(result); for (cur=start, i=0; i<slicelength; cur+=step, i++) { result_buf[i] =source_buf[cur]; }
Two approaches are possible:
Current approach (one read, Py_MIN/Py_ABS): Pre-compute the minimal covering range, read it once, then index with blob_buf[cur - read_offset]. The size_t cur += step loop is the same as bytearrayobject.c; only the offset correction differs.
N individual reads: Call sqlite3_blob_read once per element inside the loop — no Py_MIN/Py_ABS needed, but O(n) SQLite API calls instead of one.
I went with 1 to keep the number of SQLite calls minimal, but happy to switch to 2 if you prefer simpler code over fewer API calls.

I wanted to know whether you could use PySlice_AdjustIndices() but I guess not?

picnixz

Please also exercise negative stepsize when start <= end (it doesn't make sense but still it needs to be checked).

picnixz · 2026-05-26T08:25:27Z

 }
 else {
- PyObject *blob_bytes = read_multiple(self, stop - start, start);
+ // For positive step: read the contiguous range [start, stop) and


It's not a contiguous range if step != 1.

bedevere-app · 2026-05-26T08:25:42Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Reading or writing a sqlite3.Blob with a negative-step slice such as blob[9:0:-2] caused a crash (SystemError on older versions, ValueError on current main) because the C code computed stop - start as the read length, which is negative for negative steps. Fix subscript_slice() and ass_subscript_slice() in Modules/_sqlite/blob.c to handle both positive and negative steps correctly: - For step > 1: keep reading [start, stop) and indexing forward as before. - For step < -1: read the contiguous range [start+(len-1)*step, start] and index backward with stride -step.

picnixz · 2026-05-26T08:36:03Z

Please do NOT force-push; read https://devguide.python.org/getting-started/pull-request-lifecycle/ first.

ever0de · 2026-05-26T08:37:28Z

Sorry.. I executed the wrong command.

When a negative-step slice has start <= stop (e.g. blob[3:8:-1]), the slice is empty (slicelength == 0). Previously ass_subscript_slice() returned 0 immediately without acquiring the value buffer, so assigning a non-empty bytes object to such a slice silently succeeded instead of raising IndexError. Move PyObject_GetBuffer() and the size check before the len == 0 early return so that the element-count mismatch is always detected.

Exercise the case where step is negative but start <= stop, which produces an empty slice. Verify that: - blob[3:8:-1] returns b"" (no crash) - blob[3:8:-1] = b"" is a no-op - blob[3:8:-1] = b"abc" raises IndexError (wrong size) Also add blob[5:5:-1] == b"" to cover the start == stop edge case.

ever0de · 2026-05-26T09:40:17Z

I have made the requested changes; please review again

bedevere-app · 2026-05-26T09:40:23Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

serhiy-storchaka

I think this should be classified as a new feature. Please add a versionchanged directive for blob documentation and the What's New entry.

serhiy-storchaka · 2026-05-29T19:05:32Z

 return -1;
 }

- if (len == 0) {


Was there a different bug? Like blob[5:5] = None and blob[5:5] = b'123'? We need tests for such cases.

Yes, these are bugs
the original code silently ignores both type errors and size mismatches when the slice length is zero, while the same violations raise errors for non-empty slices:
Operation Result (Python 3.13.4)
blob[0:3] = b'12345' IndexError: Blob slice assignment is wrong size
blob[0:3] = None TypeError: a bytes-like object is required
blob[5:5] = b'123' no error (blob unchanged)
blob[5:5] = None no error
The same invariant (correct type, matching size) should hold regardless of whether the slice is empty.
I've added tests to cover both cases.

Classify negative-step slice support as a new feature per reviewer feedback (serhiy-storchaka): - Add versionchanged:: 3.16 directive to sqlite3.Blob documentation noting that negative-step slices are now supported. - Add What's New entry under Doc/whatsnew/3.16.rst. - Update NEWS entry wording to describe the change as a feature. - Add tests for empty-slice assignment edge cases (blob[5:5] = None and blob[5:5] = b'123') to verify TypeError and IndexError are raised correctly. - Rename read_offset to write_offset in ass_subscript_slice() since that variable is used as the offset for inner_write(), not a read.

Per devguide markup guidelines, the version argument for versionchanged should be 'next' during development; the release manager replaces it with the actual version number at release time.

…ystemError or ValueError'

…-sqlite-blob-negative-step-slice

read-the-docs-community · 2026-05-30T06:03:49Z

Documentation build overview

📚 cpython-previews | 🛠️ Build #33044570 | 📁 Comparing a462e70 against main (1c7011d)

🔍 Preview build

102 files changed · + 1 added · ± 101 modified

+Added

howto/abi3t-migration.html

±Modified

serhiy-storchaka

LGTM. 👍

…slice

serhiy-storchaka · 2026-06-03T16:45:57Z

@ever0de, as this PR combines the bug fix (for several bugs) and a new feature, it may be better to split it on two -- one for the bug fix, it will be backported, and other on the top of it only for a new feature.

ever0de · 2026-06-04T12:26:37Z

@serhiy-storchaka I opened issue #150913 for the empty-slice validation bug.

My plan is to submit a separate bug-fix PR for #150913 and remove the bug-fix changes from #150450, leaving #150450 focused on the negative-step slice feature.

Does that separation look good to you?

backlink: #150915

…ythongh-150913 The empty-slice assignment validation change (moving the len==0 early return to after buffer/type/size checks) has been split out to a separate bug-fix PR targeting issue python#150913. This branch retains only the negative-step slice feature.

serhiy-storchaka · 2026-06-04T13:49:13Z

Yes, that's it. Thank you.

…-sqlite-blob-negative-step-slice

picnixz

I would like you to either 1) explain why we need the casts 2) or remove them

picnixz · 2026-06-04T21:16:14Z

+ size_t cur;
+ Py_ssize_t i;
+ for (cur = (size_t)start, i = 0; i < len; cur += (size_t)step, i++) {
+ res_buf[i] = blob_buf[(Py_ssize_t)cur - read_offset];


OOC why all those casts? start and atep are already ssize values, and then we recast cur to ssize_t. Why not having ssize_t everywhere? there should not be any issues with signed comparisons as both operands are signed.

SSIZE_MAX + SSIZE_MAX = integer overflow.
The code is more complicated with signed integers.

Oh right. If we can add a test case for that it would be good but if it is too complex to do it (by mocking some stuff), let's forget it. I am keeping the comment unresolved so that future readers will remember

Would it be worth adding an inline comment here to explain why size_t is used instead of Py_ssize_t? Something like:
// Use size_t for 'cur' so that negative steps work via well-defined// unsigned wrap-around arithmetic. A signed accumulator would risk// undefined behaviour when start or step is near SSIZE_MAX.

No need. We use this technique in other places too. And this is not about negative steps, you will never get integer overflow in cur += step for negative step. But you get it for large positive step.
So please add a test case for something like b[5::sys.maxsize]. You can also add a test case for step=-sys.maxsize-1.

…ice operations Add test cases for sys.maxsize and -sys.maxsize-1 step values in both read (test_blob_get_slice_with_negative_step) and write (test_blob_set_slice_with_negative_step) to cover the unsigned wrap-around arithmetic path that avoids signed integer overflow.

…in sqlite3.Blob Extend the existing extreme-step test cases (sys.maxsize / -sys.maxsize-1) in test_blob_set_slice_with_negative_step to verify the blob contents were actually written correctly, not just that no crash occurred.

…p-slice

bedevere-appBot mentioned this pull request May 26, 2026
sqlite3: Blob crashes when using a negative-step slice #150449
Open

ever0de force-pushed the gh-150449-fix-sqlite-blob-negative-step-slice branch from 561ce7f to 24ade8aCompare May 26, 2026 06:58

ever0de marked this pull request as ready for review May 26, 2026 06:58

ever0de requested a review from erlend-aasland as a code owner May 26, 2026 06:58

bedevere-appBot added the awaiting review label May 26, 2026

picnixz reviewed May 26, 2026
View reviewed changes

picnixz requested changes May 26, 2026
View reviewed changes

bedevere-appBot added awaiting changes and removed awaiting review labels May 26, 2026

ever0de force-pushed the gh-150449-fix-sqlite-blob-negative-step-slice branch from 24ade8a to af0eb65Compare May 26, 2026 08:32

ever0de added 3 commits May 26, 2026 17:42

Fix PEP 7 line-length violations in blob.c (ass_subscript_slice)
83d3a3c

bedevere-appBot added awaiting change review and removed awaiting changes labels May 26, 2026

bedevere-appBot requested a review from picnixz May 26, 2026 09:40

ever0de mentioned this pull request May 26, 2026
sqlite3: fix Blob.__setitem__ value range validation RustPython/RustPython#7981
Merged

serhiy-storchaka reviewed May 29, 2026
View reviewed changes

ever0de added 3 commits May 30, 2026 13:42

pythongh-150449: Fix versionchanged version: use 'next' not '3.16'
5087b42
Per devguide markup guidelines, the version argument for versionchanged should be 'next' during development; the release manager replaces it with the actual version number at release time.

pythongh-150449: Fix wording in NEWS and whatsnew: 'crash' → 'raise S…
d774ab7
…ystemError or ValueError'

ever0de requested a review from AA-Turner as a code owner May 30, 2026 05:51

pythongh-150449: Remove redundant issue references from test comments
5bf02de

ever0de added 2 commits May 30, 2026 14:57

Merge remote-tracking branch 'upstream/main' intopythongh-150449-fix…
c311c8e
…-sqlite-blob-negative-step-slice

pythongh-150449: Fix missing blank line after xml section in whatsnew
d4b4b43

serhiy-storchaka approved these changes May 30, 2026
View reviewed changes

Comment threadModules/_sqlite/blob.c Outdated

bedevere-appBot added awaiting merge and removed awaiting change review labels May 30, 2026

pythongh-150449: Rename read_length to write_length in ass_subscript_…
0936d6b
…slice

ever0de mentioned this pull request Jun 4, 2026
sqlite3: Blob slice assignment skips validation for empty slices #150913
Closed

Merge remote-tracking branch 'upstream/main' intopythongh-150449-fix…
d47abf8
…-sqlite-blob-negative-step-slice

serhiy-storchaka approved these changes Jun 4, 2026
View reviewed changes

picnixz reviewed Jun 4, 2026
View reviewed changes

picnixz approved these changes Jun 4, 2026
View reviewed changes

ever0deand others added 4 commits June 5, 2026 16:58

pythongh-150449: Isolate extreme-step Blob assignment tests
52084f9

Merge branch 'main' intopythongh-150449-fix-sqlite-blob-negative-ste…
a462e70
…p-slice

Operation	Result (Python 3.13.4)
`blob[0:3] = b'12345'`	`IndexError: Blob slice assignment is wrong size`
`blob[0:3] = None`	`TypeError: a bytes-like object is required`
`blob[5:5] = b'123'`	no error (blob unchanged)
`blob[5:5] = None`	no error

Uh oh!

Uh oh!

Conversation

ever0de commented May 26, 2026• edited by bedevere-app BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ever0deMay 26, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-appBot commented May 26, 2026

Uh oh!

picnixz commented May 26, 2026

Uh oh!

ever0de commented May 26, 2026

Uh oh!

ever0de commented May 26, 2026

Uh oh!

bedevere-appBot commented May 26, 2026

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ever0deMay 30, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

read-the-docs-communityBot commented May 30, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

serhiy-storchaka commented Jun 3, 2026

Uh oh!

ever0de commented Jun 4, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serhiy-storchaka commented Jun 4, 2026

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serhiy-storchakaJun 5, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ever0de commented May 26, 2026•
edited by bedevere-app Bot
Loading

ever0deMay 26, 2026•
edited
Loading

ever0deMay 30, 2026•
edited
Loading

read-the-docs-communityBot commented May 30, 2026•
edited
Loading

ever0de commented Jun 4, 2026•
edited
Loading

serhiy-storchakaJun 5, 2026•
edited
Loading